GDPR isnt there to stop spam. Spammers don't give two hoots about GDPR, because they're normally offshore shell companies easily folded, hidden and reborn before any sort of legislation can get near them.
It's there to protect your privacy by making organisations which hold your data accountable.
And making sure they give you a choice in how your data is processed. And making sure they protect it.
It has changed companies from saying "oh it was our IT guys fault, so we fired him, all good now" - if they lose their customer data, that's going to be the head of sales who is accountable, left the accounts data on a unprotected cloud server? that's the finance director that is now accountable.
Which puts the responsibility for looking after your data firmly at board level.
Given the size of the fines being slapped about by the EU on companies after a breach and dataloss, companies are having to seriously look at "should we really be holding all this stuff", "do we have a retention policy, do we enforce it" and "what controls do we have around this data"? And some of them are now throwing proper investment at it, because its still cheaper than a £3m fine.
Cookie popups on browsers are annoying, and a great example of what could have been a good idea 15 years ago, slowly and badly implemented and now turned into a quagmire of pish and slop.
